CVE - CVE-2023-44487

CVE-ID
CVE-2023-44487	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20231016-0001/ CONFIRM:https://security.netapp.com/advisory/ntap-20240426-0007/ CONFIRM:https://security.netapp.com/advisory/ntap-20240621-0006/ CONFIRM:https://security.netapp.com/advisory/ntap-20240621-0007/ DEBIAN:DSA-5521 URL:https://www.debian.org/security/2023/dsa-5521 DEBIAN:DSA-5522 URL:https://www.debian.org/security/2023/dsa-5522 DEBIAN:DSA-5540 URL:https://www.debian.org/security/2023/dsa-5540 DEBIAN:DSA-5549 URL:https://www.debian.org/security/2023/dsa-5549 DEBIAN:DSA-5558 URL:https://www.debian.org/security/2023/dsa-5558 DEBIAN:DSA-5570 URL:https://www.debian.org/security/2023/dsa-5570 FEDORA:FEDORA-2023-0259c3f26f URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ FEDORA:FEDORA-2023-17efd3f2cd URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ FEDORA:FEDORA-2023-1caffb88af URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ FEDORA:FEDORA-2023-2a9214af5f URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ FEDORA:FEDORA-2023-3f70b8d406 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ FEDORA:FEDORA-2023-492b7be466 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ FEDORA:FEDORA-2023-4bf641255e URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ FEDORA:FEDORA-2023-4d2fd884ea URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ FEDORA:FEDORA-2023-54fadada12 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ FEDORA:FEDORA-2023-5ff7bf1dd8 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ FEDORA:FEDORA-2023-7934802344 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ FEDORA:FEDORA-2023-7b52921cae URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ FEDORA:FEDORA-2023-822aab0a5a URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ FEDORA:FEDORA-2023-b2c50535cb URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ FEDORA:FEDORA-2023-c0c6a91330 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ FEDORA:FEDORA-2023-d5030c983c URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ FEDORA:FEDORA-2023-dbe64661af URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ FEDORA:FEDORA-2023-e9c04d81c1 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ FEDORA:FEDORA-2023-ed2642fd58 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ FEDORA:FEDORA-2023-f66fc0f62a URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ FEDORA:FEDORA-2023-fe53e13b5b URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ GENTOO:GLSA-202311-09 URL:https://security.gentoo.org/glsa/202311-09 MISC:https://access.redhat.com/security/cve/cve-2023-44487 MISC:https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ MISC:https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ MISC:https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack MISC:https://blog.vespa.ai/cve-2023-44487/ MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2242803 MISC:https://bugzilla.suse.com/show_bug.cgi?id=1216123 MISC:https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 MISC:https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 MISC:https://github.com/Azure/AKS/issues/3947 MISC:https://github.com/Kong/kong/discussions/11741 MISC:https://github.com/advisories/GHSA-qppj-fm5r-hxr3 MISC:https://github.com/advisories/GHSA-xpw8-rcwv-8f8p MISC:https://github.com/akka/akka-http/issues/4323 MISC:https://github.com/apache/apisix/issues/10320 MISC:https://github.com/apache/httpd-site/pull/10 MISC:https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 MISC:https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 MISC:https://github.com/caddyserver/caddy/releases/tag/v2.7.5 MISC:https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 MISC:https://github.com/etcd-io/etcd/issues/16740 MISC:https://github.com/junkurihara/rust-rpxy/issues/97 MISC:https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 MISC:https://github.com/kazu-yamamoto/http2/issues/93 MISC:https://github.com/kubernetes/kubernetes/pull/121120 MISC:https://github.com/line/armeria/pull/5232 MISC:https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 MISC:https://github.com/ninenines/cowboy/issues/1615 MISC:https://github.com/openresty/openresty/issues/930 MISC:https://github.com/opensearch-project/data-prepper/issues/3474 MISC:https://github.com/oqtane/oqtane.framework/discussions/3367 MISC:https://github.com/projectcontour/contour/pull/5826 MISC:https://github.com/tempesta-tech/tempesta/issues/1986 MISC:https://github.com/varnishcache/varnish-cache/issues/3996 MISC:https://istio.io/latest/news/security/istio-security-2023-004/ MISC:https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ MISC:https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q MISC:https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html MISC:https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html MISC:https://netty.io/news/2023/10/10/4-1-100-Final.html MISC:https://news.ycombinator.com/item?id=37837043 MISC:https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected MISC:https://security.paloaltonetworks.com/CVE-2023-44487 MISC:https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 MISC:https://ubuntu.com/security/CVE-2023-44487 MISC:https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 MISC:https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event MISC:https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 MISC:https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ MISC:https://www.openwall.com/lists/oss-security/2023/10/10/6 MISC:https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ MISC:https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ URL:https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ MISC:https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ URL:https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ MISC:https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ URL:https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ MISC:https://bugzilla.proxmox.com/show_bug.cgi?id=4988 URL:https://bugzilla.proxmox.com/show_bug.cgi?id=4988 MISC:https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 URL:https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 MISC:https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ URL:https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ MISC:https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack URL:https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack MISC:https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve URL:https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve MISC:https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 URL:https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 MISC:https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 URL:https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 MISC:https://github.com/advisories/GHSA-vx74-f528-fxqg URL:https://github.com/advisories/GHSA-vx74-f528-fxqg MISC:https://github.com/alibaba/tengine/issues/1872 URL:https://github.com/alibaba/tengine/issues/1872 MISC:https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 URL:https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 MISC:https://github.com/apache/trafficserver/pull/10564 URL:https://github.com/apache/trafficserver/pull/10564 MISC:https://github.com/bcdannyboy/CVE-2023-44487 URL:https://github.com/bcdannyboy/CVE-2023-44487 MISC:https://github.com/caddyserver/caddy/issues/5877 URL:https://github.com/caddyserver/caddy/issues/5877 MISC:https://github.com/dotnet/announcements/issues/277 URL:https://github.com/dotnet/announcements/issues/277 MISC:https://github.com/eclipse/jetty.project/issues/10679 URL:https://github.com/eclipse/jetty.project/issues/10679 MISC:https://github.com/envoyproxy/envoy/pull/30055 URL:https://github.com/envoyproxy/envoy/pull/30055 MISC:https://github.com/facebook/proxygen/pull/466 URL:https://github.com/facebook/proxygen/pull/466 MISC:https://github.com/golang/go/issues/63417 URL:https://github.com/golang/go/issues/63417 MISC:https://github.com/grpc/grpc-go/pull/6703 URL:https://github.com/grpc/grpc-go/pull/6703 MISC:https://github.com/h2o/h2o/pull/3291 URL:https://github.com/h2o/h2o/pull/3291 MISC:https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf URL:https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf MISC:https://github.com/haproxy/haproxy/issues/2312 URL:https://github.com/haproxy/haproxy/issues/2312 MISC:https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 URL:https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 MISC:https://github.com/micrictor/http2-rst-stream URL:https://github.com/micrictor/http2-rst-stream MISC:https://github.com/microsoft/CBL-Mariner/pull/6381 URL:https://github.com/microsoft/CBL-Mariner/pull/6381 MISC:https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 URL:https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 MISC:https://github.com/nghttp2/nghttp2/pull/1961 URL:https://github.com/nghttp2/nghttp2/pull/1961 MISC:https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 URL:https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 MISC:https://github.com/nodejs/node/pull/50121 URL:https://github.com/nodejs/node/pull/50121 MISC:https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo URL:https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo MISC:https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html URL:https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html MISC:https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ URL:https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ MISC:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 URL:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 MISC:https://my.f5.com/manage/s/article/K000137106 URL:https://my.f5.com/manage/s/article/K000137106 MISC:https://news.ycombinator.com/item?id=37830987 URL:https://news.ycombinator.com/item?id=37830987 MISC:https://news.ycombinator.com/item?id=37830998 URL:https://news.ycombinator.com/item?id=37830998 MISC:https://news.ycombinator.com/item?id=37831062 URL:https://news.ycombinator.com/item?id=37831062 MISC:https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ URL:https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ MISC:https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ URL:https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ MISC:https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ URL:https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ MISC:https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack URL:https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack MLIST:[debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update URL:https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html MLIST:[debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update URL:https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html MLIST:[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update URL:https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html MLIST:[debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update URL:https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html MLIST:[debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update URL:https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html MLIST:[debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update URL:https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html MLIST:[debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update URL:https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html MLIST:[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations URL:http://www.openwall.com/lists/oss-security/2023/10/13/4 MLIST:[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations URL:http://www.openwall.com/lists/oss-security/2023/10/13/9 MLIST:[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations URL:http://www.openwall.com/lists/oss-security/2023/10/18/8 MLIST:[oss-security] 20231018 Vulnerability in Jenkins URL:http://www.openwall.com/lists/oss-security/2023/10/18/4 MLIST:[oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST URL:http://www.openwall.com/lists/oss-security/2023/10/19/6 MLIST:[oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations URL:http://www.openwall.com/lists/oss-security/2023/10/20/8
Assigning CNA
MITRE Corporation
Date Record Created
20230929	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230929)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.